01Responsible party and scope
This Policy applies to personal data processed by NEXROOT for operating the website, accounts, and related services. Certain products may have additional privacy notices or contractual terms. Where NEXROOT processes data on a customer's instructions, that customer may determine the purposes of processing under the applicable arrangement.
02Information we may collect
- Identity and contact information: name, email, phone number, job title, and organization details.
- Account information: registration, verification status, permissions, and organization membership.
- Transaction information: selected packages, orders, subscriptions, invoices, and payment status or references.
- Service data: assessment answers, results, recommendations, uploaded evidence, and activity records.
- Technical data: IP address, browser and device information, error logs, and cookies as applicable.
- Communications: inquiries, support requests, feedback, and content you choose to submit.
Uploaded evidence may contain personal data about others. The uploading organization is responsible for having an appropriate lawful basis and minimizing unnecessary data.
03How we use information
- To create and verify accounts and administer users and organization permissions.
- To deliver assessments, save progress, and generate results, reports, and recommendations.
- To administer orders, subscriptions, entitlements, billing, and related transactions.
- To provide support and send essential service and security notices.
- To protect systems, prevent misuse, and diagnose technical issues.
- To improve service quality and comply with applicable legal obligations.
04Legal bases for processing
Processing is based on the applicable legal basis for each purpose, which may include performing a contract, fulfilling a legal obligation, legitimate interests where permitted, or consent where required. Accepting the Terms of Use does not, by itself, constitute blanket consent to all processing or marketing communications.
05Payments and service providers
Payments may be processed by an approved payment provider for the selected service. NEXROOT may receive transaction references, payment status, and information needed for invoicing and reconciliation without needing to store full card credentials. We may also use hosting, email, technical support, and operational providers subject to appropriate contractual and legal safeguards.
07International data transfers
Where a service requires personal data to be transferred outside Saudi Arabia, the transfer must comply with applicable requirements and safeguards. Actual hosting locations and recipient details should be confirmed against the deployed services.
08Retention and deletion
Data is retained as necessary for processing purposes, contractual obligations, or legal requirements. It is then securely deleted, destroyed, or de-identified where appropriate. Certain financial, audit, or backup records may require longer retention. Account closure does not necessarily result in immediate removal of all related records.
09Information security
NEXROOT applies appropriate technical and organizational safeguards, including access controls and security monitoring as implemented in its services. No technical system can be guaranteed completely risk-free.
11Your rights
Subject to Saudi Arabia's Personal Data Protection Law and applicable regulations, you may have rights to be informed, access your data, obtain a copy, request correction or destruction, and withdraw consent where consent is the legal basis, subject to legal exceptions. We may verify your identity before processing a request.
12Changes to this Policy
We may update this Policy to reflect service or regulatory changes. The approved version and its effective date will be published, and material changes will be communicated where appropriate.
13Contact and privacy requests
For privacy inquiries or requests, email contact@nexroot.io. You may include “Privacy Request” in the subject line.